Upgrade to Pro — share decks privately, control downloads, hide ads and more …

EASM mistakes waiting to happen

Avatar for JR0ch17 JR0ch17
January 25, 2022
Technology
0
41

EASM mistakes waiting to happen

Avatar for JR0ch17

JR0ch17

January 25, 2022
Tweet

More Decks by JR0ch17

See All by JR0ch17
Traversing my way in the internal network
Avatar for JR0ch17 jr0ch17
0
140
Getting Started in Bug Bounty
Avatar for JR0ch17 jr0ch17
0
110
Getting Blindly Lucky
Avatar for JR0ch17 jr0ch17
0
75
Qu'est-ce que le bug bounty?
Avatar for JR0ch17 jr0ch17
0
110
Finding 5 bugs in a single parameter
Avatar for JR0ch17 jr0ch17
0
80
Beyond the Borders of Scope
Avatar for JR0ch17 jr0ch17
0
66
Bad API, hAPI Hackers!
Avatar for JR0ch17 jr0ch17
0
1.6k

Other Decks in Technology

See All in Technology
Google Agentspaceを実際に導入した効果と今後の展望
Avatar for MIXI ENGINEERS mixi_engineers
PRO
2
260
モバイルゲームの開発を支える基盤の歩み ～再現性のある開発ラインを量産する秘訣～
Avatar for QualiArts qualiarts
0
1.1k
Gemini in Android Studio - Google I/O Bangkok '25
Avatar for Somkiat Khitwongwattana akexorcist
0
180
【CEDEC2025】ブランド力アップのためのコンテンツマーケティング～ゲーム会社における情報資産の活かし方～
Avatar for Cygames cygames
PRO
0
230
S3 Glacier のデータを Athena からクエリしようとしたらどうなるのか/try-to-query-s3-glacier-from-athena
Avatar for emi emiki
0
140
AI コードレビューが面倒すぎるのでテスト駆動開発で解決しようとして読んだら、根本的に俺の勘違いだった
Avatar for Mutz mutsumix
0
160
AI人生苦節10年で会得したAIがやること_人間がやること.pdf
Avatar for shibuiwilliam shibuiwilliam
1
270
AI時代の経営、Bet AI Vision #BetAIDay
Avatar for LayerX layerx
PRO
1
1.6k
ビジネス文書に特化した基盤モデル開発 / SaaSxML_Session_2
Avatar for Sansan R&D sansan_randd
0
250
多様なニーズに応える Movable Type ラインナップ 全紹介
Avatar for hayase masakah
0
120
Power Automate のパフォーマンス改善レシピ / Power Automate Performance Improvement Recipes
Avatar for Takashi Shinohara karamem0
0
290
SAE J1939シミュレーション環境構築
Avatar for okzkey daikiokazaki
1
220

Featured

See All Featured
Cheating the UX When There Is Nothing More to Optimize - PixelPioneers
Avatar for Stéphanie Walter stephaniewalter
283
13k
Git: the NoSQL Database
Avatar for Brandon Keepers bkeepers
PRO
431
65k
The Success of Rails: Ensuring Growth for the Next 100 Years
Avatar for Eileen M. Uchitelle eileencodes
46
7.5k
It's Worth the Effort
Avatar for 3n 3n
185
28k
Learning to Love Humans: Emotional Interface Design
Avatar for Aarron Walter aarron
273
40k
GraphQLの誤解/rethinking-graphql
Avatar for sonatard sonatard
71
11k
[RailsConf 2023] Rails as a piece of cake
Avatar for Vladimir Dementyev palkan
56
5.7k
Mobile First: as difficult as doing things right
Avatar for Swwweet swwweet
223
9.8k
The Power of CSS Pseudo Elements
Avatar for Geoffrey Crofte geoffreycrofte
77
5.9k
Rebuilding a faster, lazier Slack
Avatar for samanthasiow samanthasiow
83
9.1k
[RailsConf 2023 Opening Keynote] The Magic of Rails
Avatar for Eileen M. Uchitelle eileencodes
29
9.6k
Put a Button on it: Removing Barriers to Going Fast.
Avatar for kastner kastner
60
3.9k

Transcript

  1. EASM mistakes waiting to happen

  2. GET /whoami HTTP/2 Jasmin Landry JR0ch17 Lead, IT & Security

    at Montreal Canadiens fan

  3. GET /agenda HTTP/2 EASM Common mistakes Hacker perspective

  4. GET /EASM HTTP/2 What exactly is EASM? What does it

    cover? Why is it important?

  5. GET /common_mistakes HTTP/2 Lack of Change Management Not respecting Least

    Privilege Misconfigured WAFs Cloud misconfigs (S3 buckets)

  6. GET /hacker_perspective HTTP/2 • Subdomains • IPs • TLS certificates

    • Third-party apps Recon EVERYTHING • Monitor for new assets • Monitor any change Continuous Monitoring

  7. GET /thanks HTTP/2 Thank you for listening Questions? More questions?

    DMs are open on and